AI-103 Developing AI Apps and Agents on Azure: A Practical 2026 Guide

What AI-103 measures

Exam AI-103: Developing AI Apps and Agents on Azure is aimed at Azure AI engineers who build, manage, and deploy agents and AI solutions with Microsoft Foundry. The official audience profile says candidates should have experience developing applications with Python and familiarity with general AI, generative AI, and Azure services. Responsibilities span planning and management, generative and agentic systems, computer vision, text analysis, and information extraction.

That breadth changes how preparation should work. It is not enough to recognize model names or produce a successful playground response. A credible candidate can explain how identity reaches a data source, how retrieval produces a citation, why a tool cannot authorize itself, how an image can carry an indirect prompt attack, how layout quality changes RAG quality, how traces expose an agent loop, and how to remove paid resources after a lab.

Use the five-phase AI-103 roadmap to convert these percentages into a practical sequence. Give the two largest domains most of your time, but connect every smaller domain to an end-to-end architecture. A document assistant, for example, can involve vision, text, extraction, retrieval, an agent tool, managed identity, safety, monitoring, and cost in one scenario.

Domain 1: plan and manage the complete Azure AI solution

Model selection begins with the task. A low-cost classifier, a complex policy reasoner, a code assistant, and an image-grounded workflow do not automatically belong on the same deployment. Create representative evaluation data and compare candidate large language models, small models, code models, multimodal models, and Foundry Tools on quality, instruction following, modality, context, safety, latency, regional availability, quota, and total cost. Model size is not an acceptance criterion.

Architecture selection also includes retrieval, indexing, knowledge, memory, and tools. Frequently changing cited knowledge suggests RAG rather than storing facts in model weights. An existing governed enterprise index suggests Azure AI Search as an agent knowledge tool. A small uploaded file collection can suggest File Search. Sandboxed computation suggests Code Interpreter. An external action suggests a custom function, Azure Function, OpenAPI tool, Logic App, or MCP integration—but only after the team understands credentials, data destinations, validation, and blast radius.

Foundry projects, model deployments, agent definitions, instructions, connections, index configurations, safety settings, and evaluation datasets should be treated as release artifacts. Version them. Promote them through environments. Run semantic quality and safety gates in addition to conventional unit, integration, and security tests. Deploy progressively, observe a candidate, and retain a known rollback target. An HTTP 200 check proves availability, not correctness.

Identity, private access, and secrets

Prefer Microsoft Entra authentication and managed identity for supported Azure service connections. Managed identity removes stored service keys from application configuration, while Azure role-based access control defines what that identity can do. Assign data-plane roles deliberately and at the narrowest useful scope. Resource management access does not necessarily imply permission to read model, search, storage, or monitoring data.

Private endpoints provide private IP connectivity to supported resources, but a secure design also needs private DNS, correct subnet and network policy, controlled outbound dependencies, and a deliberate public network setting. Validate the full path before disabling public access. Otherwise, an application can fail because one model, Search, Storage, monitoring, or tool dependency still resolves publicly. Store unavoidable third-party secrets in Key Vault, never in prompts, browser JavaScript, source code, or traces.

Quota, cost, safety, and observability

Foundry model capacity is constrained through applicable token, request, and concurrency limits that vary by model, deployment type, subscription, region, or newer shared quota pool. Diagnose throttling by measuring the limiting dimension. Smooth load, use bounded exponential backoff with jitter, control concurrency, and reallocate or request capacity only after measurement. Unlimited immediate retries amplify throttling.

Responsible AI is a system property. Configure appropriate content filters, Azure AI Content Safety, Prompt Shields, moderation, provenance, human oversight, and approval workflows. Test false positives and false negatives. Keep identity, authorization, resource scope, and high-impact policy outside the model. A safety classifier can detect a risky input; it cannot grant access or prove a transaction is permitted.

Microsoft Foundry observability combines evaluation, production monitoring, and distributed tracing. Application Insights and OpenTelemetry can expose model calls, retrieval, tools, dependencies, errors, latency, and token use. Semantic metrics—groundedness, relevance, citation support, safety, tool accuracy, and task completion—must sit beside infrastructure metrics. Protect telemetry because prompts, retrieved chunks, model responses, identities, and tool payloads can contain sensitive content.

Domain 2: build generative and agentic solutions

A generative application needs a model endpoint, an explicit prompt and context contract, resilient request handling, safety behavior, evaluation, and an application integration. Structured tasks should define an output schema and validate the returned object. Lower randomness can improve consistency for extraction, but no parameter replaces schema validation. Conversation history should be bounded and relevant; stale context increases token use and can preserve instructions that no longer apply.

RAG before fluent answers

Retrieval-augmented generation separates changing knowledge from model weights. Azure AI Search can store searchable text, vectors, filters, and source metadata. Ingestion can use indexers and skillsets with integrated chunking and vectorization, or an application can preprocess content and push documents. At query time, keyword search captures exact terms, vector search captures semantic similarity, hybrid search runs both and fuses their results, and semantic ranking can rerank strong candidates where appropriate.

Evaluate retrieval before generation. Did the correct source enter the candidate set? Did an authorization filter remove it? Was the answer sentence split from its heading or table? Were indexed and query vectors produced by compatible embeddings? Is the index fresh? Only then evaluate answer correctness, groundedness, citation validity, refusal quality, latency, and token cost. Raising generation temperature cannot restore missing evidence.

Foundry Agent Service and tool boundaries

Foundry Agent Service describes an agent through three core elements: a model, instructions, and tools. The model reasons, instructions establish goals and constraints, and tools provide knowledge or actions. The platform adds runtimes, conversation handling, managed tools, identity integrations, tracing, metrics, and lifecycle support.

Tool choice should follow the requirement. Azure AI Search grounds the agent in an existing index. File Search supports uploaded document knowledge. Web search can provide current public-web evidence but has specific terms, data-boundary considerations, and cost. Code Interpreter runs Python in a sandboxed environment for analysis. Function calling lets the application execute a custom function. Azure Functions, OpenAPI, Logic Apps, and MCP can connect external capabilities. Review the current Foundry tool catalog because availability and preview status change.

Every model-proposed tool argument is untrusted input. Trusted code must validate type, range, identity, resource, business policy, idempotency, timeout, and authorization before invoking a downstream system. Return bounded structured results and structured errors. Separate read identities from write identities. Consequential actions should enter a deterministic approval state, and operators should retain a kill switch that disables write capability independently of the agent.

Multi-agent designs multiply these concerns. Give each agent a bounded role, narrow tools, explicit inputs and outputs, trace correlation, and defined terminal or escalation states. An orchestrator should prevent cycles and enforce time, iteration, and cost budgets. A handoff is an API contract, not a vague instruction to “work together.”

Evaluate behavior, not personality

Agent evaluation should include task adherence and completion, intent resolution, navigation efficiency, tool selection, tool-input accuracy, tool-call success, tool-output use, grounding, relevance, safety, latency, and tokens. Include ordinary requests, ambiguous requests, missing evidence, malformed tool output, transient failures, direct and indirect attacks, approval rejection, replay, and loops. Calibrate automated evaluators against human judgment for subjective or high-risk cases. Each production failure should become a sanitized regression case.

Domain 3: implement computer vision responsibly

The vision domain combines generation, editing, understanding, and safety. For generated images or video, understand the conceptual workflow: text and reference inputs, platform-supported controls, masks and inpainting, prompt-driven edits, review, safety, provenance, and current model limitations. Do not memorize a static model list. Verify current model, region, API, deployment, and content-policy support.

For understanding, decide whether a focused API or a multimodal model fits. Azure Vision Image Analysis can provide OCR, tags, objects, people, smart crops, an overall caption, and dense captions for multiple regions with bounding boxes, subject to current feature and region support. Multimodal models fit broad visual questions. Azure Content Understanding fits schema-defined extraction and RAG-ready representations across images and video. Video Indexer fits deeper audio and video insight scenarios.

Accessibility output needs evaluation, not blind publication. Review concise alt text and extended descriptions for important content, sequence, spatial relations, uncertainty, and unnecessary detail. Test missing and invented objects. Respect current language support. Visual safety includes harmful-image classification and organizational policy such as brand or watermark requirements. It also includes indirect prompt injection: text hidden or printed in an image remains untrusted content and must not override system policy or tool authorization.

Domain 4: implement text analysis and speech

Azure Language in Foundry Tools provides prebuilt capabilities such as named entity recognition, PII detection, language detection, sentiment analysis and opinion mining, key phrase extraction, and summarization, plus selected customizable capabilities. Choose a prebuilt operation when it provides the required structured result and supported language. Use generative prompting when flexible schema-based reasoning is needed, but validate structured output and compare it with specialized services.

NER and PII are not synonyms. NER identifies broad entity categories such as people, organizations, locations, and dates. PII detection focuses on supported sensitive information and redaction use cases. The organization still defines what must be masked, retained, encrypted, reviewed, or deleted. Opinion mining adds aspect-level sentiment, such as positive service but negative battery life, rather than forcing one label onto a mixed review.

Translation can use Azure Translator in Foundry Tools or an LLM-powered flow depending on language support, fidelity, format, context, latency, safety, and cost. Domain customization should follow a baseline. Do not customize merely because a feature exists.

Speech workflows require choices between real-time and batch transcription, interactive and asynchronous synthesis, translation, and custom adaptation. Start with representative audio. If equipment names remain weak, evaluate phrase lists or custom speech and measure both recognition and end-to-end task success. Text to speech can use voices and SSML for delivery, but voice consent, disclosure, accessibility, privacy, and current limited-access conditions still matter.

Domain 5: implement information extraction and grounding

Information extraction begins before OCR. Validate files, media type, size, duplicates, metadata, and source approval. Isolate failures and record a content hash and correlation identifier. Then preserve structure: headings, paragraphs, tables, figures, pages, regions, timestamps, and speaker turns can all become retrieval evidence.

Microsoft's document-processing guidance helps distinguish Content Understanding and Document Intelligence. Document Intelligence is a strong fit for focused OCR and layout, prebuilt standard forms, and labeled custom models for highly structured documents. Content Understanding is a strong fit for multimodal, unstructured, schema-defined, reasoning-oriented, and RAG-ready output across documents, images, audio, and video. The correct choice still depends on measured field accuracy, modality, labels, layout, language, confidence, latency, deployment, and cost.

Layout-aware Markdown helps RAG preserve headings and tables. Structure-aware chunks can keep a heading with its paragraph, a table header with its values, or a figure with nearby explanation. Store page or region provenance with every chunk. Build human review for low confidence, inconsistent totals, safety-sensitive fields, and schema failures. Record the original value, correction, reviewer, reason, source evidence, and analyzer version. Corrections should become evaluation data, not silent claims that the model “learned.”

Monitor ingestion as a production system: failed files, queue age, analyzer latency, throttling, OCR and field drift, PII outcomes, indexer errors, enrichment quality, vector consistency, freshness, retrieval relevance, and cost. A healthy search endpoint can still serve a stale or badly parsed index.

Two projects that cover the blueprint

The AI-103 portfolio projects turn the domains into substantial synthetic systems. The first is a secure cited multi-tool support agent. It uses Azure AI Search grounding, read-only diagnostic functions, and a confirmation-gated idempotent ticket writer. It adds managed identity, RBAC, private endpoint planning, prompt-attack tests, traces, semantic evaluation, budgets, incident rehearsal, and cleanup.

The second is a multimodal document and vision extraction workflow. It compares Content Understanding, Document Intelligence, Vision, Language, Speech, and multimodal models. It preserves layout and visual provenance, applies PII and safety policy, routes uncertainty to human review, indexes approved evidence for hybrid search, monitors quality and cost, and deletes every dedicated resource.

Both projects deliberately avoid copy-paste deployment scripts in the article. Azure regions, quotas, APIs, identities, resource dependencies, and organizational controls differ. Use the official portal or SDK documentation for the exact environment, review every operation, use disposable synthetic resources, and never execute destructive cleanup until the retained-resource list is verified.

An eight-to-ten-week AI-103 study plan

1. Week 1: Read the current study guide. Map every bullet to a service, implementation decision, risk, and evidence type. Refresh Microsoft Entra ID, managed identity, RBAC, private endpoints, DNS, retries, and cost basics.
2. Week 2: Create a Foundry project in a sandbox, compare models with a small evaluation set, understand deployment and quota choices, and connect Application Insights.
3. Weeks 3-4: Build cited RAG with Azure AI Search. Test parsing, chunks, embeddings, exact terms, vectors, hybrid retrieval, filters, semantic ranking, citations, and insufficient-evidence behavior.
4. Week 5: Build a Foundry agent with one read-only tool. Add strict schemas, bounded iterations, structured errors, traces, tool evaluators, and an approval design for any future write.
5. Week 6: Practice Image Analysis and multimodal understanding. Create reviewed captions and region descriptions, test visual evidence questions, and test indirect instructions embedded in images.
6. Week 7: Practice NER, PII, sentiment and opinion mining, summarization, speech recognition, synthesis, and translation decisions with representative languages and domain terms.
7. Week 8: Compare Content Understanding and Document Intelligence on scanned, structured, and mixed-media synthetic files. Preserve Markdown, tables, figures, fields, confidence, and provenance.
8. Weeks 9-10: Complete the two portfolio projects, run safety and quality gates, optimize tokens and retrieval, rehearse incidents, review every weak domain, and clean up all Azure resources.

Use original AI-103 practice questions to test scenario reasoning and AI-103 flashcards for retrieval practice. Do not memorize option letters. Explain which requirement the correct answer satisfies and which safety, identity, relevance, or lifecycle requirement each distractor violates.

Common preparation mistakes

• Studying only chat completions. AI-103 covers architecture, agents, tools, vision, language, speech, extraction, safety, operations, and cost.
• Putting authorization in a prompt. A prompt is not an RBAC role, trusted identity, validation boundary, or approval workflow.
• Evaluating only final prose. Inspect ingestion, retrieval, citations, tool choice, arguments, state transitions, safety, and task completion.
• Flattening documents. Lost headings, tables, figures, and page locations produce weak retrieval and unverifiable answers.
• Logging everything. Full prompts, retrieved chunks, audio, images, and tool payloads can duplicate sensitive data into telemetry.
• Assuming feature availability. Models, APIs, preview features, quotas, regions, languages, and deployment types change.
• Forgetting cleanup. Model deployments, Search capacity, private endpoints, logs, storage, analyzers, and network resources can continue billing.
• Using exam dumps. Recalled protected content undermines exam integrity and creates brittle knowledge with no implementation evidence.

Certification and career expectations

AI-103 can structure a broad Azure AI learning path and provide a useful credential signal. It cannot guarantee an interview, job, promotion, or salary. Stronger evidence combines the certification with Python code, an architecture diagram, identity and network reasoning, retrieval tests, tool contracts, safety analysis, trace screenshots with sanitized data, evaluation reports, cost measurements, and an honest record of model failures and human corrections.

Use the PrepKloud jobs explorer to compare your skills with role descriptions, and continue through the PrepKloud blog for responsible AI, agents, DevAI/Ops, cloud engineering, and portfolio guidance. Avoid claiming production experience for a sandbox project; label synthetic work clearly.

Official Microsoft references

• Study guide for Exam AI-103: Developing AI Apps and Agents on Azure
• What is Microsoft Foundry Agent Service?
• Foundry Agent Service tool catalog
• Retrieval-augmented generation in Azure AI Search
• Vector search in Azure AI Search
• Azure AI Content Safety overview
• Observability in generative AI with Microsoft Foundry
• Azure Vision Image Analysis overview
• Azure Language in Foundry Tools overview
• Azure Speech to text documentation
• Choose the right Foundry Tool for document processing
• RAG with Azure Document Intelligence

Continue your AI-103 preparation

• AI-103 five-phase roadmap
• AI-103 original practice questions
• AI-103 flashcards
• AI-103 portfolio projects
• Cloud and AI jobs
• PrepKloud certification and career blog
• PrepKloud editorial policy

Frequently asked questions